{"id":"EUVD-2025-26075","enisaUuid":"3266e4db-2c51-3598-9bd2-2e3bb15590dc","description":"FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.","datePublished":"Aug 28, 2025, 12:00:00 AM","dateUpdated":"Aug 28, 2025, 8:03:21 PM","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/FormCms/FormCms/issues/27\nhttps://github.com/KKC73/me/blob/main/CVE-2025-56236/README.md\n","aliases":"CVE-2025-56236\nGHSA-4fxf-xgrm-8fcj\n","assigner":"mitre","epss":0.2,"enisaIdProduct":[{"id":"6648957f-1b57-388e-8e6c-936f5f01e600","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"enisaIdVendor":[{"id":"6aa05046-cfe5-3c85-ba73-e2979b116ebb","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"77e73a07-3fec-3c79-bb0c-d4b777bee8f3","vulnerability":{"id":"CVE-2025-56236","description":"FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.","datePublished":"Aug 28, 2025, 12:00:00 AM","dateUpdated":"Aug 28, 2025, 8:03:21 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/FormCms/FormCms/issues/27\nhttps://github.com/KKC73/me/blob/main/CVE-2025-56236/README.md\n","enisa_id":"EUVD-2025-26075\n","assigner":"mitre","epss":0.2,"dataProcessed":"Nov 8, 2026, 7:13:54 AM","vulnerabilityProduct":[{"id":"30371cc9-3a10-4526-98fb-8f0c97a1705c","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"},{"id":"8aa48387-9926-34f8-a4b2-eb19750c25c2","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"vulnerabilityVendor":[{"id":"1013bff1-ec3d-359e-8f86-cef68520f183","vendor":{"name":"n/a"}}]}},{"id":"d4a49d21-b5e7-3331-a74f-940c4734e0ab","vulnerability":{"id":"GHSA-4fxf-xgrm-8fcj","description":"FormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability","datePublished":"Aug 28, 2025, 3:30:42 PM","dateUpdated":"Aug 28, 2025, 4:47:04 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-56236\nhttps://github.com/FormCms/FormCms/issues/27\nhttps://github.com/KKC73/me/blob/main/CVE-2025-56236/README.md\nhttps://github.com/formcms/formcms\n","enisa_id":"EUVD-2025-26075\n","aliases":"CVE-2025-56236\nGHSA-4fxf-xgrm-8fcj\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:12:44 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}